{"record":{"id":"42941b82b1a2afc6","repo":"elsa-workflows/elsa-core","slug":"the-openid-connect-connection-configuration-is-invalid","errorCode":null,"errorMessage":"The OpenID Connect connection configuration is invalid.","messagePattern":"The OpenID Connect connection configuration is invalid\\.","errorType":"exception","errorClass":"OpenIdConnectAuthenticationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication.OpenIdConnect/Services/OpenIdConnectExternalAuthenticationAdapter.cs","lineNumber":131,"sourceCode":"        return new(ConnectionObservationStatus.Succeeded, \"reachable\", \"Provider metadata was resolved.\", []);\n    }\n\n    public async ValueTask<ExternalLogoutRequest?> CreateLogoutRequestAsync(ExternalLogoutContext context, CancellationToken cancellationToken = default)\n    {\n        var settings = await GetSettingsAsync(context.Connection.Connection.AdapterSettings, cancellationToken);\n        var metadata = await ResolveMetadataAsync(settings, cancellationToken);\n        if (metadata.EndSessionEndpoint is null)\n            return null;\n        var query = new Dictionary<string, string> { [\"post_logout_redirect_uri\"] = GetLogoutCallbackUri(context.Connection).AbsoluteUri, [\"state\"] = context.CorrelationState };\n        if (context.UpstreamLogoutHint is not null)\n            query[\"id_token_hint\"] = context.UpstreamLogoutHint.Reveal();\n        return new(WithQuery(metadata.EndSessionEndpoint, query), []);\n    }\n\n    private async Task<OpenIdConnectConnectionSettings> GetSettingsAsync(JsonElement settings, CancellationToken cancellationToken)\n    {\n        if (!settingsParser.TryParse(settings, out var parsed, out _))\n            throw new OpenIdConnectAuthenticationException(\"The OpenID Connect connection configuration is invalid.\");\n        await Task.CompletedTask;\n        return parsed!;\n    }\n\n    private async Task<ProviderMetadata> ResolveMetadataAsync(OpenIdConnectConnectionSettings settings, CancellationToken cancellationToken)\n    {\n        if (settings.TrustMode == OpenIdConnectTrustMode.Manual)\n            return new(settings.Issuer!, settings.AuthorizationEndpoint!, settings.TokenEndpoint!, settings.UserInfoEndpoint, settings.EndSessionEndpoint, settings.JwksUri, settings.SigningKeys);\n\n        var address = settings.DiscoveryUrl ?? throw new OpenIdConnectAuthenticationException(\"The OpenID Connect discovery URL is required.\");\n        var response = await providerHttpClient.GetAsync(address, ProviderResponseKind.Discovery, cancellationToken);\n        if (!response.IsSuccessStatusCode)\n            throw new OpenIdConnectAuthenticationException(\"The identity provider metadata could not be resolved.\");\n        using var document = ParseProviderJson(response.Body, \"The identity provider metadata could not be resolved.\");\n        var root = document.RootElement;\n        var issuer = GetRequiredHttpsUri(root, \"issuer\").AbsoluteUri.TrimEnd('/');\n        var authorizationEndpoint = GetRequiredHttpsUri(root, \"authorization_endpoint\");\n        var tokenEndpoint = GetRequiredHttpsUri(root, \"token_endpoint\");","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication.OpenIdConnect/Services/OpenIdConnectExternalAuthenticationAdapter.cs#L113-L149","documentation":"GetSettingsAsync parses the connection's AdapterSettings JSON through a settings parser. If parsing fails (required fields missing or values malformed), the adapter throws this OpenIdConnectAuthenticationException instead of proceeding with partial settings, indicating the OpenID Connect connection configuration is invalid.","triggerScenarios":"Any flow (initiation, callback, TestAsync) that calls GetSettingsAsync on a connection whose AdapterSettings JSON does not pass the settings parser's validation.","commonSituations":"Typo in JSON keys of the connection settings; issuer/endpoints supplied with invalid URI values; required fields left out when TrustMode is Manual; JSON saved as an object with unexpected nesting.","solutions":["Open the connection settings JSON and validate it against the expected OpenIdConnectConnectionSettings fields (issuer, discoveryUrl or manual endpoints, clientId, etc.).","For TrustMode.Manual, ensure Issuer, AuthorizationEndpoint and TokenEndpoint are all populated since discovery will be skipped.","Paste the settings JSON into a JSON validator and check for syntax errors, wrong types (numbers vs strings), or trailing commas."],"exampleFix":"// before (invalid: missing tokenEndpoint in manual mode)\n{ \"trustMode\": \"Manual\", \"issuer\": \"https://idp.example.com\", \"authorizationEndpoint\": \"https://idp.example.com/authorize\" }\n// after\n{ \"trustMode\": \"Manual\", \"issuer\": \"https://idp.example.com\", \"authorizationEndpoint\": \"https://idp.example.com/authorize\", \"tokenEndpoint\": \"https://idp.example.com/token\", \"clientId\": \"my-client\" }","handlingStrategy":"validation","validationCode":"try { JsonDocument.Parse(adapterSettingsJson); } catch (JsonException ex) { throw new InvalidOperationException(\"Connection settings JSON is malformed: \" + ex.Message); }","typeGuard":null,"tryCatchPattern":"try { await adapter.TestAsync(testContext); } catch (OpenIdConnectAuthenticationException ex) when (ex.Message.Contains(\"configuration is invalid\")) { return Results.ValidationProblem(new Dictionary<string, string[]> { [\"settings\"] = [\"OpenID Connect connection settings are invalid.\"] }); }","preventionTips":["Validate connection settings JSON against the expected schema before saving.","For Manual trust mode, always fill issuer, authorizationEndpoint, tokenEndpoint and clientId.","Use a JSON linter to catch syntax errors in stored settings."],"tags":["openid-connect","configuration","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}